Three weeks ago, a large-scale cyberattack targeted refrigeration systems in supermarkets in France. Now the same thing has happened in Germany, where retailers were primarily affected.
On Monday, Italy, Ireland, the Netherlands and Portugal also reported attacks on freezing and cooling systems. In these attacks, hackers manipulate or simply shut down the refrigeration of food products. So far, there is no information about the perpetrators or their motives.
In this case, it appears that both the manufacturers of refrigeration equipment and the retail chains themselves have made it easier for the attackers: the cooling equipment at one or more sites can be configured centrally via software. The control system–metaphorically speaking–is located completely unprotected outside the shop door, without any firewall, ARD explains.
„The supermarkets themselves simply connected these unprotected systems directly to the internet, without any oversight. And anyone who gains access to them via the internet can then manipulate the entire system," computer specialist Manuel Atug from the Critical Infrastructure Working Group, which works to improve IT security, told the public broadcaster.
The law classifies retail chains as „critical infrastructure“ if they serve 500,000 people or more. „But even if a company serves fewer people, it may still fall under the legislation for important or highly important facilities, which requires the introduction of cybersecurity measures,“ Atug adds.
Even ministries do not meet security standards
According to a study by the National Research Center for Applied Cybersecurity, even federal ministries fail to meet the necessary security standards. They have outdated equipment connected to the network, security vulnerabilities that have not been fixed, as well as a lack of requirements for service providers. These gaps are often not included in security status reports prepared by the Federal Office for Information Security (BSI).
When people think of „critical infrastructure“, they usually mean energy supplies, financial systems or the healthcare sector. However, there are also other vital facilities that remain outside the scope of this definition, says Haya Shulman, a professor of cybersecurity at Goethe University Frankfurt:
„There are numerous service providers and organizations on which we are heavily dependent but which do not fall under this classification. A cyberattack could, for example, delay the construction or repair of vital transport links and utility infrastructure. That is why it is crucial to include the protection of the entire chain of suppliers and service providers.“
100% security does not exist
Scientific research aims to make systems more resilient–a task that must be carried out urgently in view of the rapidly expanding capabilities of artificial intelligence (AI). Today, hackers can use AI-based tools to identify security vulnerabilities more quickly than before and with less technical knowledge. At the same time, however, artificial intelligence also helps fix these vulnerabilities faster.
Cybersecurity expert Louis Al Sardi from Friedrich-Alexander University Erlangen-Nuremberg notes that absolute 100-percent security has never existed in the field of cybersecurity. Artificial intelligence will not change that either, he assures.
It has always been, and remains, impossible to prevent every single attack. That is why research focuses on increasing the resilience of computer systems so that they can continue to function even after an attack has taken place. Artificial intelligence (AI) can help in this regard–provided it is reliable.
Above all, however, retail chains should at least protect the control systems of their refrigeration installations with a firewall.